appcheap vulnerabilities

Products

• App Builder – Create Native Android & iOS Apps On The Flight 2

Latest appcheap CVEs

Newest publication first

1. CVE-2026-7638 App Builder <= 5.5.10 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Avatar Modification via 'user_id' Parameter

   Published 2026-05-02

   Medium·CVSS 5.3

   The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.0. This is due to missing authorization validation in the upload_avatar() function, which accepts an att...

2. CVE-2026-2375 App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter

   Published 2026-03-21

   Medium·CVSS 6.5

   The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the verify_role() function in AuthTrails.php explicitly whitelisting the wcfm_vendor role along...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.